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READ POLICY CONFIGURATION INFORMATION INCLUDING A GLOBAL 
THREAT ASSESSMENT EVENT GENERATION PROBABILITY AND ONE OR 
MORE DYNAMIC THREAT ASSESSMENT RULES 



GENERATE ONE OR MORE ABSTRACT DATA TYPES FOR EACH OF THE 

ONE OR MORE DYNAMIC THREAT ASSESSMENT RULES 
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COLLECT EVENTS FROM THE ONE OR MORE SECURITY DEVICES IN AN 
EVENT COLLECTION DATABASE 



I 



READ THE NEXT EVENT IN THE EVENT COLLECTION DATABASE 




250 



.265 



ADD THE EVENT TO THE INSTANCE AND COMPUTE 
THE PROBABILITY OF THE INSTANCE 



GENERATE A DYNAMIC 
THREAT ASSESSMENT 
EVENT AND PLACE IT IN 
THE EVENT COLLECTION 
DATABASE 
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IS THE 

YES PROBABILITY 

OF THE INSTANCE 
GREATER THAN 

THE GLOBAL 
.PROBABILITY?^ 
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IS 

THE EVENT" 
A STARTING 
MEMBER OF 
AN INSTANCE OF 
AN ABSTRACT 
DATA 
TYPE?. 



YES 



CREATE AN INSTANCE OF THE ABSTRACT DATA 
TYPE AND ADD THE EVENT TO THE INSTANCE 
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^ START ^ 
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RECEIVE AN EVENT FROM A SECURITY DEVICE IN AN EVENT 
COLLECTION DATABASE 
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IF THE EVENT MATCHES AN UNPOPULATED MEMBER OF AN INSTANCE OF 
AN ABSTRACT DATA TYPE THAT REPRESENTS A RULE THAT DESCRIBES 
HOW EVENTS ARE COMBINED TO FORM A THREAT. ADD THE EVENT TO 
THE INSTANCE AND COMPUTE A PROBABILITY OF THE INSTANCE 



IF THE PROBABILITY OF THE INSTANCE IS GREATER THAN A GLOBAL 
THREAT ASSESSMENT EVENT GENERATION PROBABILITY, GENERATE A 
SECOND EVENT AND PLACE THE SECOND EVENT IN THE EVENT 
COLLECTION DATABASE 



1 f 

^ END ^ 
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